Skip to content

Commit aa10581

Browse files
chopmob-cloudchopmob-cloud
committed
ci: pin GitHub Actions to commit SHAs
Pin the GitHub Actions in .github/workflows to full-length commit SHAs with version comments. A mutable tag can be re-pointed after review, so pinning to a commit SHA is the OpenSSF Scorecard Pinned-Dependencies control. Ref-pinning only, same versions, no functional change. Generated with pinact; each SHA verified to resolve to its version tag. Signed-off-by: AlgoVoi <chopmob@gmail.com>
1 parent e649325 commit aa10581

10 files changed

Lines changed: 40 additions & 40 deletions

File tree

‎.github/workflows/acts-nightly.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,23 +19,23 @@ jobs:
1919

2020
steps:
2121
- name: Checkout code
22-
uses: actions/checkout@v7
22+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2323

2424
- name: Install uv
25-
uses: astral-sh/setup-uv@v7
25+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
2626

2727
- name: Clone a2a-itk
28-
uses: actions/checkout@v7
28+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2929
with:
3030
repository: a2aproject/a2a-itk
3131
ref: main
3232
path: itk/a2a-itk
3333

3434
- name: Set up Docker Buildx
35-
uses: docker/setup-buildx-action@v4
35+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
3636

3737
- name: Build itk_service image (GHA layer cache)
38-
uses: docker/build-push-action@v7
38+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
3939
with:
4040
context: itk/a2a-itk
4141
tags: itk_service:latest
@@ -44,7 +44,7 @@ jobs:
4444
cache-to: type=gha,mode=max,scope=itk_service
4545

4646
- name: Cache launcher peer-SDK checkouts + build outputs
47-
uses: actions/cache@v6
47+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
4848
with:
4949
path: ~/.cache/a2a-itk-launcher
5050
key: itk-launcher-${{ runner.os }}-${{ github.sha }}
@@ -67,7 +67,7 @@ jobs:
6767

6868
- name: Upload ACTS reports
6969
if: always()
70-
uses: actions/upload-artifact@v7
70+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
7171
with:
7272
name: acts-reports-python-nightly
7373
path: itk/acts-report-*.json
@@ -77,7 +77,7 @@ jobs:
7777
retention-days: 30
7878

7979
- name: Upload ACTS Results to Rolling Release
80-
uses: softprops/action-gh-release@v3
80+
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
8181
with:
8282
# The conformance counterpart of `itk_python.json`, on the same
8383
# permanent tag: `process_acts_results.py` fetches

‎.github/workflows/acts.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,23 +28,23 @@ jobs:
2828

2929
steps:
3030
- name: Checkout code
31-
uses: actions/checkout@v7
31+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3232

3333
- name: Install uv
34-
uses: astral-sh/setup-uv@v7
34+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
3535

3636
- name: Clone a2a-itk
37-
uses: actions/checkout@v7
37+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3838
with:
3939
repository: a2aproject/a2a-itk
4040
ref: main
4141
path: itk/a2a-itk
4242

4343
- name: Set up Docker Buildx
44-
uses: docker/setup-buildx-action@v4
44+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
4545

4646
- name: Build itk_service image (GHA layer cache)
47-
uses: docker/build-push-action@v7
47+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
4848
with:
4949
context: itk/a2a-itk
5050
tags: itk_service:latest
@@ -53,7 +53,7 @@ jobs:
5353
cache-to: type=gha,mode=max,scope=itk_service
5454

5555
- name: Cache launcher peer-SDK checkouts + build outputs
56-
uses: actions/cache@v6
56+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
5757
with:
5858
path: ~/.cache/a2a-itk-launcher
5959
key: itk-launcher-${{ runner.os }}-${{ github.sha }}
@@ -75,7 +75,7 @@ jobs:
7575

7676
- name: Upload ACTS reports
7777
if: always()
78-
uses: actions/upload-artifact@v7
78+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
7979
with:
8080
name: acts-reports-python
8181
path: itk/acts-report-*.json

‎.github/workflows/coverage-comment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ jobs:
1818
github.event.workflow_run.conclusion == 'success'
1919
steps:
2020
- name: Download Coverage Artifacts
21-
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
21+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
2222
with:
2323
run-id: ${{ github.event.workflow_run.id }}
2424
github-token: ${{ secrets.A2A_BOT_PAT }}
2525
name: coverage-data
2626

2727
- name: Upload Coverage Report
2828
id: upload-report
29-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
29+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3030
with:
3131
name: coverage-report
3232
path: coverage/

‎.github/workflows/install-smoke.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626
python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
2727
steps:
2828
- name: Checkout code
29-
uses: actions/checkout@v7
29+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3030

3131
- name: Install uv
32-
uses: astral-sh/setup-uv@v7
32+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
3333
with:
3434
python-version: ${{ matrix.python-version }}
3535

‎.github/workflows/itk.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,23 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v7
25+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2626

2727
- name: Install uv
28-
uses: astral-sh/setup-uv@v7
28+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
2929

3030
- name: Clone a2a-itk
31-
uses: actions/checkout@v7
31+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3232
with:
3333
repository: a2aproject/a2a-itk
3434
ref: main
3535
path: itk/a2a-itk
3636

3737
- name: Set up Docker Buildx
38-
uses: docker/setup-buildx-action@v4
38+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
3939

4040
- name: Build itk_service image (GHA layer cache)
41-
uses: docker/build-push-action@v7
41+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
4242
with:
4343
context: itk/a2a-itk
4444
tags: itk_service:latest
@@ -47,7 +47,7 @@ jobs:
4747
cache-to: type=gha,mode=max,scope=itk_service
4848

4949
- name: Cache launcher peer-SDK checkouts + build outputs
50-
uses: actions/cache@v6
50+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
5151
with:
5252
path: ~/.cache/a2a-itk-launcher
5353
key: itk-launcher-${{ runner.os }}-${{ github.sha }}

‎.github/workflows/linter.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
with:
2828
python-version-file: .python-version
2929
- name: Install uv
30-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
30+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
3131
- name: Add uv to PATH
3232
run: |
3333
echo "$HOME/.cargo/bin" >> $GITHUB_PATH

‎.github/workflows/nightly.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,23 @@ jobs:
1515

1616
steps:
1717
- name: Checkout code
18-
uses: actions/checkout@v7
18+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1919

2020
- name: Install uv
21-
uses: astral-sh/setup-uv@v7
21+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
2222

2323
- name: Clone a2a-itk
24-
uses: actions/checkout@v7
24+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2525
with:
2626
repository: a2aproject/a2a-itk
2727
ref: main
2828
path: itk/a2a-itk
2929

3030
- name: Set up Docker Buildx
31-
uses: docker/setup-buildx-action@v4
31+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
3232

3333
- name: Build itk_service image (GHA layer cache)
34-
uses: docker/build-push-action@v7
34+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
3535
with:
3636
context: itk/a2a-itk
3737
tags: itk_service:latest
@@ -40,7 +40,7 @@ jobs:
4040
cache-to: type=gha,mode=max,scope=itk_service
4141

4242
- name: Cache launcher peer-SDK checkouts + build outputs
43-
uses: actions/cache@v6
43+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
4444
with:
4545
path: ~/.cache/a2a-itk-launcher
4646
key: itk-launcher-${{ runner.os }}-${{ github.sha }}
@@ -56,7 +56,7 @@ jobs:
5656
ITK_SKIP_BUILD: "1"
5757

5858
- name: Upload Results to Rolling Release
59-
uses: softprops/action-gh-release@v3
59+
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
6060
with:
6161
tag_name: "nightly-metrics"
6262
prerelease: true

‎.github/workflows/python-publish.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
1616

1717
- name: Install uv
18-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
18+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
1919

2020
- name: "Set up Python"
2121
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v6
@@ -26,7 +26,7 @@ jobs:
2626
run: uv build
2727

2828
- name: Upload distributions
29-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
29+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3030
with:
3131
name: release-dists
3232
path: dist/
@@ -40,7 +40,7 @@ jobs:
4040

4141
steps:
4242
- name: Retrieve release distributions
43-
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
43+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4444
with:
4545
name: release-dists
4646
path: dist/

‎.github/workflows/run-tck.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
4040

4141
- name: Install uv
42-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
42+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
4343
with:
4444
enable-cache: true
4545
cache-dependency-glob: "uv.lock"

‎.github/workflows/unit-tests.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
echo "MYSQL_TEST_DSN=mysql+aiomysql://a2a:a2a_password@localhost:3306/a2a_test" >> $GITHUB_ENV
5858
5959
- name: Install uv for Python ${{ matrix.python-version }}
60-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
60+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
6161
with:
6262
python-version: ${{ matrix.python-version }}
6363
- name: Add uv to PATH
@@ -102,7 +102,7 @@ jobs:
102102
echo ${{ github.event.pull_request.base.ref || 'main' }} > ./BASE_BRANCH
103103
104104
- name: Upload Coverage Artifacts
105-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
105+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
106106
if: github.event_name == 'pull_request' && matrix.python-version == '3.14'
107107
with:
108108
name: coverage-data
@@ -120,7 +120,7 @@ jobs:
120120
run: uv run pytest --cov=a2a --cov-report term --cov-fail-under=88
121121

122122
- name: Upload Artifact (base)
123-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
123+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
124124
if: github.event_name != 'pull_request' && matrix.python-version == '3.14'
125125
with:
126126
name: coverage-report

0 commit comments

Comments
 (0)